huntrule

Linux Process Command-Line Printing of Shell History Files

Alerts when Linux commands print or page shell history files via the command line for recon.

FreeReviewedSigma · Medium · v2
Product
linux
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-06-20
Updated
2026-07-31
AnalysisDetection
title: Linux Process Command-Line Printing of Shell History Files
id: d73c0c73-0df1-432e-9f7a-2b709d042d92
status: test
description: This rule flags Linux process executions where the command line invokes common file-viewing utilities (cat/head/tail/more) and targets shell history files such as /.bash_history and /.zsh_history, including history-related filename suffixes. Attackers may use this behavior to quickly recover previously executed commands for reconnaissance and follow-on activity. It relies on process creation telemetry capturing the invoked image name and full command line content.
references:
  - https://github.com/sleventyeleven/linuxprivchecker/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_history_recon.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-20
modified: 2022-09-15
tags:
  - attack.reconnaissance
  - attack.t1592.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - /cat
      - /head
      - /tail
      - /more
  selection_history:
    - CommandLine|contains:
        - /.bash_history
        - /.zsh_history
    - CommandLine|endswith:
        - _history
        - .history
        - zhistory
  condition: all of selection*
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: d7821ff1-4527-4e33-9f84-d0d57fa2fb66
    type: derived